CVE-2025-2357

Name of the Vulnerable Software and Affected Versions: DCMTK version 3.6.9

Description: A critical vulnerability was found in the dcmjpls JPEG-LS Decoder component of DCMTK, affecting unknown code and leading to memory corruption. The attack can be initiated remotely. The manipulation with the dcmjpls component can cause memory corruption.

Recommendations: To fix this issue, it is recommended to apply a patch, specifically the patch named 3239a7915, to DCMTK version 3.6.9. As a temporary workaround, consider disabling the dcmjpls JPEG-LS Decoder component until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation.